cis-ubuntu1804-v220-1-1-1-3

name	cis-ubuntu1804-v220-1-1-1-3
description	Ensure mounting of jffs2 filesystems is disabled
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","filesystem","jffs2","kernel-module"]
cis_id	1.1.1.3
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure mounting of jffs2 filesystems is disabled

Profile

Level 1 - Server / Level 1 - Workstation, Assessment: Automated

Description

The jffs2 (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

Impact

None noted.

Audit Procedure

Command Line

Run the following script to verify the jffs2 module is disabled. If the module is available in the running kernel:

• An entry including /bin/true or /bin/false exists in a file within the /etc/modprobe.d/ directory
• The module is deny listed in a file within the /etc/modprobe.d/ directory
• The module is not loaded in the kernel

If available in ANY installed kernel:

• The module is deny listed in a file within the /etc/modprobe.d/ directory

#!/usr/bin/env bash
{
    l_output="" l_output2="" l_output3="" l_dl=""
    l_mname="jffs2"
    l_mtype="fs"
    l_searchloc="/lib/modprobe.d/*.conf /usr/local/lib/modprobe.d/*.conf /run/modprobe.d/*.conf /etc/modprobe.d/*.conf"
    l_mpath="/lib/modules/**/kernel/$l_mtype"
    l_mpname="$(tr '-' ' ' <<< "$l_mname")"
    l_mndir="$(tr '-' '/' <<< "$l_mname")"

    module_loadable_chk()
    {
        l_loadable="$(modprobe -n -v "$l_mname")"
        [ "$(wc -l <<< "")" -gt  ] && l_loadable=
         grep -Pq --  <<< ; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
         ! lsmod | grep  > /dev/null 2>&1; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
        l_dl=
         modprobe --showconfig | grep -Pq -- ; 
            l_output=
        
            l_output2=
        
    }
     l_mdir  ; 
         [ -d  ] && [ -n  ]; 
            l_output3=
            [  !=  ] && module_deny_chk
             [  =  ]; 
                module_loadable_chk
                module_loaded_chk
            
        
            l_output=
        
    
    [ -n  ] &&  -e 
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}